Lessons from FactCheck.LT research team:

TikTok has evolved from dance challenges and memes into a critical platform for narrative formation and information spread. Through its uniquely visual and networked content ecosystem, it offers real-time insights into public discourse for researchers, fact-checkers, and policy teams.

This guide provides a practical, evidence-based workflow for monitoring disinformation on TikTok, drawn from extensive research conducted by FactCheck.LT across multiple election cycles in Eastern Europe.

Why TikTok Analytics Matter for Disinformation Research?

TikTok's algorithm doesn't just reflect cultural trends—it actively shapes them. Our analysis reveals how political narratives consistently piggyback on entertainment content, viral sounds, and creator networks to reach audiences who rarely consume traditional news.

The platform's trend engine operates through interconnected relationships between sounds, hashtags, effects, and creators. When you map co-occurrences around topics, you can identify when fringe narratives begin bridging into mainstream communities, providing early warning signals for disinformation spread. Context becomes everything in this environment, as trends form in relation to other trends rather than in isolation.

What are the essential elements that need to be monitored?

1. Hashtag Networks and Narrative Scaffolding

Disinformation rarely travels under a single hashtag. Instead, it builds complex scaffolding through clusters of adjacent hashtags that create bridges between different communities. Our research on Belarusian TikTok toxic hashtags revealed how health-focused tags served as bridges to political content, allowing narratives to cross community boundaries that would otherwise remain separate.

The key insight is monitoring not just primary hashtags but the entire neighborhood of related tags. High-overlap neighbors, community clusters, and peripheral nodes often foreshadow the next framing evolution. By examining these relationship patterns over time, core frames can be distinguished from opportunistic hijacks.

Image source: Exolyt

Research Source: Toxic Narratives: Belarusian TikTok and the Art of Digital Manipulation

In July’s update, Exolyt added the ability to choose a custom time period in their very complex and impressive charts of related hashtags. Analysis of this chart prompted the investigation of an even more massive hashtag – “змагары” / “fighters”.

2. Audio Templates as Cross-Language Carriers

Audio templates carry ideas across linguistic barriers faster than text-based content. Political slogans traveling via viral audio represent one of the most effective methods for narrative amplification, with identical calls-to-action appearing under seemingly unrelated content. During election periods, we consistently observed this pattern as an indicator of orchestration rather than organic spread.

The velocity of audio adoption across different language communities provides critical intelligence about narrative coordination. When the same audio template appears simultaneously across multiple linguistic contexts, especially in compressed timeframes, it suggests coordinated amplification rather than natural viral spread.

3. Comment Intelligence and Ground Truth

Comment sections often reveal coordination that the main content carefully obscures. Our analysis of TikTok comments during summer 2025 demonstrated how comment timelines and phrase-level examination help distinguish playful memetics from deliberate persuasion attempts and brigading operations.

Image source: Exolyt

Research Source: How pro-government Belarusian TikToks commented

Repetitive phrasing across different videos, time-compressed comment bursts, and copy-paste calls-to-action emerge as clear signals of coordination. The temporal compression of identical messaging across unrelated content provides particularly strong evidence of orchestrated activity rather than organic community response.

4. Creator Networks and Micro-Influencer Chains

Narratives ride micro-influencer chains with remarkable efficiency. The most effective influence operations identify creators who sit across multiple communities and repeatedly seed political framings across diverse topics. These boundary-spanning accounts become critical nodes for narrative amplification.

Analysis requires tracking not just individual creator metrics but network-level patterns, including growth bursts, cross-tag activity, audience overlaps, and collaboration patterns. Networks that move together, posting similar content within compressed timeframes or showing synchronized engagement patterns, indicate potential coordination beyond organic community dynamics.

5. Geo-linguistic Community Signals

TikTok's community structure, organized around hashtags like #BookTok and #PoliTikTok, provides analytical shortcuts for understanding narrative flow. Segmenting topics by geography and language reveals when communities with naturally low overlap suddenly share tags or sounds, indicating external intervention or targeted narrative seeding.

Our research across Belarus, Poland, and Romania demonstrated how diaspora, border, and minority- language audiences often become early targets for narrative testing. These communities serve as testing grounds for messaging that later scales to larger populations, making them critical early warning indicators.

*Exolyt Protip

However, tackling the complexities of multilingual social listening could be a major challenge when analyzing social data. There are already so many cultural nuances to consider, and now one must also overcome the bias of English-centric data to truly unlock the richness of other languages and generate more inclusive and accurate global insights. Recognizing the importance of audio, Exolyt has introduced video transcriptions to support better content analysis.

So, if you are a social listening expert facing this challenge, try out Exolyt and experience the convenience of instant video content insights 🔥

6. Visual Intelligence Beyond Captions

Influence operations increasingly embed messaging in on-screen text, logos, or visual elements that captions never mention. Frame-level analysis catches dog-whistles and off-caption narratives that keyword-only monitoring systems miss entirely. This visual layer often contains the most sensitive or controversial messaging, deliberately separated from searchable text.

The distinction between on-caption and off-caption content reveals intent and sophistication levels. Content designed to evade detection systems typically embeds key messaging visually while maintaining innocuous captions, creating plausible deniability while ensuring message transmission to intended audiences.

7. Temporal Pattern Recognition

Authentic trends demonstrate natural breathing patterns in their growth and engagement. Inorganic pushes spike at unusual hours, display mechanically regular intervals, or fall into repeated daily cadences that suggest automation rather than human community behavior.

Overlaying hashtag growth curves, posting frequency patterns, and comment velocity creates signatures that distinguish manufactured amplification from organic community engagement. These temporal fingerprints become particularly valuable when combined with creator network analysis and content similarity metrics.

Example of Creator Network Analytics as captured on Exolyt.

Image source: Exolyt

Research Source: Belarus as a Launchpad: TikTok Videos Push Kremlin Narratives into Moldova

How to maintain a systematic monitoring workflow for disinformation research?

• Establishing Scope and Parameters

Effective monitoring begins with a clear definition of the threat landscape, whether focused on elections, migration narratives, health misinformation, or regional geopolitics. Successful programs establish seed parameters, including three to five core hashtags, two to three trending sounds, and ten to twenty key creators who demonstrate cross-community influence.

Objectives must be explicit and measurable, such as "detect emerging false claims about postal voting procedures" or "track cross-border propaganda targeting minority language communities." This specificity enables focused data collection and prevents scope creep that dilutes analytical effectiveness.

• Network Mapping and Relationship Analysis

Building comprehensive relationship maps for each seed hashtag reveals the broader ecosystem of connected content and communities. These maps highlight high-overlap neighbors, community clustering patterns, and peripheral nodes that often signal emerging narrative directions.

Weekly snapshots of these relationship networks capture evolution over time, revealing how clusters form, merge, or fragment in response to external events or internal community dynamics. The peripheral nodes deserve particular attention, as they frequently foreshadow the next iteration of narrative framing.

• Creator Intelligence and Network Analysis

Developing watchlists of accounts that span multiple communities or repeatedly appear near monitored tags and sounds creates the foundation for network-level analysis. These creators often serve as bridges between communities, carrying narratives across traditional boundaries.

Triangulation across growth patterns, engagement metrics, and comment sentiment reveals networks operating in coordination. The most sophisticated operations maintain plausible individual account behavior while demonstrating clear coordination at the network level through synchronized posting, shared narrative elements, or coordinated engagement patterns.

• Comment Mining and Phrase Analysis

Regular extraction of comments from watchlist accounts and high-engagement content mentioning target topics provides ground truth about community response versus orchestrated messaging. Simple n-gram analysis of top replies surfaces repeated scripts and talking points that indicate coordinated messaging campaigns.

Time-compressed bursts of similar phrasing across unrelated videos provide particularly strong evidence of coordination. Anomalies in comment velocity, especially when combined with repeated phrasing patterns, distinguish authentic community engagement from manufactured amplification.

• Visual Content Analysis

Systematic frame-level analysis searches for embedded keywords, slogans, visual cues, including signage, party symbols, and URLs that captions deliberately omit. This visual intelligence layer often contains the most sensitive messaging, designed to reach intended audiences while evading text-based detection systems.

Documentation requires careful categorization of findings as on-caption versus off-caption content, with the latter often indicating deliberate obfuscation strategies. Screenshot capture for documentation purposes must balance evidence preservation with responsible disclosure practices.

• Reporting and Intelligence Products

Effective reporting tracks narrative peaks through hashtags and sound growth visualization while maintaining focus on actionable intelligence. Weekly briefings should address four core questions: what moved, who moved it, why it matters, and what response is recommended.

The challenge lies in avoiding re-amplification of harmful content while providing sufficient evidence for decision-making. Cropped screenshots, network diagrams with sensitive details blurred, and aggregate pattern analysis serve this balance between transparency and responsibility.

Examples of Election Cycle Case Studies by FactCheck

• Poland: Cross-Border Narrative Laundering

Our cross-border monitoring documented systematic narrative testing and laundering from Belarus-linked media ecosystems into Polish-language TikTok content ahead of electoral periods. The operation repackaged talking points through relatable creators, bypassing domestic media ecosystems to reach younger voters directly.

Timeline analysis of Polish-language content spikes, combined with creator network mapping, revealed how short-form video content circumvented traditional fact-checking processes. The sophistication lay not in the individual content pieces but in the systematic approach to creator recruitment and narrative timing.

Source: How TikTok influenced the results of the presidential election in Poland by FactCheck

• Romania: Hashtag Velocity and Campaign Dynamics

The 2024-2025 Romanian election cycle demonstrated rapid hashtag evolution around candidates and policy issues. Political messaging consistently piggybacked on entertainment trends to reach audiences who actively avoided political content.

Comment-level analysis proved essential for distinguishing organic community response from coordinated persuasion efforts. Identical phrasing appearing across unrelated videos within compressed timeframes provided clear evidence of coordination, while relationship mapping revealed how political narratives bridged into entertainment communities through shared audio templates and creator collaborations.

Source: The Battle between Romanian Presidential Candidates on TikTok by FactCheck

• Albania: Fragmented Networks and Identity Politics

Albanian TikTok demonstrated fragmented, fast-spiking hashtag clusters where political identity content merged with lifestyle trends through TikTok's duet and stitch mechanisms. The platform's native collaboration features became tools for narrative amplification across community boundaries.

Network relationship mapping provided early visibility into narrative bridge formation, enabling analysts to establish more effective monitoring parameters for subsequent campaign iterations. The case highlighted how community fragmentation can actually accelerate narrative spread by creating multiple simultaneous amplification pathways.

Source: Political hashtags trending on Albanian TikTok

What ethical frameworks and protocols should be maintained in this research methodology?

• Privacy and Platform Responsibility

Research methodology must respect both individual privacy and platform terms of service. Working exclusively with public data prevents privacy violations while maintaining analytical effectiveness.

Deanonymization attempts compromise ethical standards and research validity by shifting the focus from behavioral patterns to individual targeting.

Platform terms compliance ensures sustainable research practices and maintains access for ongoing monitoring. Violations risk not only individual account suspension but broader restrictions that could compromise community-level research capabilities.

• Harm Reduction in Research Practice

Research reporting must balance transparency with harm reduction, avoiding amplification of the very narratives being studied. Cropped screenshots, network diagrams with sensitive details blurred, and aggregate pattern presentation serve this balance between evidence and responsibility.

The downstream effects of research publication require careful consideration, as academic or policy analysis can inadvertently provide operational guidance for malicious actors. Context provision and methodology explanation must weigh educational value against potential misuse.

• Analytical Rigor and Evidence Standards

Not every anomaly indicates coordination or malicious intent. Robust analysis requires multiple converging signals rather than single-point evidence. Temporal patterns combined with creator network reuse and off-caption visual signals provide stronger foundations for attribution than any individual metric.

Documentation standards must ensure reproducibility while protecting sensitive sources and methods. Archived URLs, timestamped screenshots, and methodology transparency enable verification without compromising ongoing monitoring capabilities or source protection.

How to implement a disinformation tracking strategy?

Phase One: Infrastructure Development

Successful implementation begins with clear threat surface definition encompassing topic focus, geographic scope, and linguistic parameters. Seed parameter establishment creates the foundation for systematic expansion, starting with three to five core hashtags, two to three trending sounds, and ten to twenty boundary-spanning creators.

Baseline relationship mapping establishes the starting point for trend analysis, capturing existing community structures and narrative flows before monitoring period initiation. This baseline enables detection of changes that might otherwise appear as normal platform activity.

Phase Two: Systematic Monitoring

Weekly creator watchlist updates capture evolving influence networks and emerging narrative bridges. Comment pattern analysis reveals coordination signals that content-level monitoring might miss. Frame-level visual review catches embedded messaging designed to evade text-based detection systems.

Temporal anomaly detection combines multiple signal sources to identify manufactured amplification patterns. The integration of hashtag velocity, posting frequency, engagement patterns, and comment timing creates comprehensive signatures of organic versus coordinated activity.

Phase Three: Intelligence Production

Weekly narrative briefings synthesize monitoring results into actionable intelligence, addressing emerging threats, key amplification networks, impact assessments, and recommended responses. Evidence archival maintains investigative trails while documentation protocols ensure reproducibility and verification capabilities.

Stakeholder communication requires tailoring intelligence products to audience needs, whether academic research, policy development, or operational response. Counter-narrative recommendation development completes the intelligence cycle by enabling proactive rather than purely reactive strategies.

What are the strategic implications of disinformation tracking?

Disinformation operations thrive on TikTok's core affordances: algorithmic amplification, authentic messengers, and rapid content velocity. However, when approached systematically, these same characteristics create opportunities for early detection and response.

The key insight from our research across multiple election cycles is that sophisticated influence operations leave detectable signatures across multiple analytical dimensions. No single metric provides definitive attribution, but converging evidence from network analysis, temporal patterns, content similarity, and engagement anomalies creates robust detection capabilities.

Success requires treating TikTok not as a chaotic information environment but as a structured system with predictable patterns and detectable anomalies. With a systematic approach combining relationship mapping, comment intelligence, and comprehensive content review, social media monitoring transforms from reactive damage assessment to proactive threat detection.

The ultimate goal is to convert social media noise into decision-ready intelligence fast enough to enable effective response. This requires not just analytical sophistication but operational discipline, ethical grounding, and clear communication of both capabilities and limitations to stakeholders who depend on this intelligence for critical decisions.

This guide on tracking disinformation propaganda is compiled and drawn from extensive research conducted by FactCheck.LT across multiple election cycles and influence operations. Their research publications provide detailed case studies and methodology documentation.